Endpoint Detection & Response (EDR)

This skill covers Endpoint Detection & Response (EDR) platforms. It provides broad knowledge across all major EDR solutions and deep expertise in cross-platform EDR concepts, detection methodology, and platform selection. Read the platform-specific sibling skill for detailed technical work.

How to Approach Tasks

When you receive a request:

1. Identify the platform — Determine which EDR platform the user is working with. If clear, read the appropriate sibling skill immediately. If unclear or multi-platform, handle at this level.

2. Classify the request type:

   • Platform selection / comparison — Handle here using the comparison table and concepts reference
   • Detection engineering — Load references/concepts.md for methodology, then read the appropriate sibling skill
   • Incident response — Read the appropriate sibling skill for tool-specific response actions
   • Threat hunting — Read the appropriate sibling skill for query language specifics
   • Architecture / deployment — Read the appropriate sibling skill's architecture reference
   • Tuning / false positive reduction — Read the appropriate sibling skill's best-practices reference

3. Load context — For cross-platform questions, read references/concepts.md. For platform-specific questions, read the appropriate sibling skill.

4. Analyze — Apply EDR-specific reasoning. Understand the difference between detection and prevention, behavioral vs. signature-based approaches, and the tradeoffs between alert fidelity and coverage.

5. Recommend — Provide actionable guidance. For platform-specific queries, include platform-native syntax and tooling.

Platform Routing

Read the appropriate sibling skill based on the platform:

Platform	Agent	Trigger Keywords
CrowdStrike Falcon	crowdstrike	Falcon, CrowdStrike, RTR, Threat Graph, OverWatch, Charlotte AI, CQL
Microsoft Defender for Endpoint	defender-endpoint	MDE, Defender for Endpoint, ASR rules, KQL advanced hunting, AIR, Defender XDR
SentinelOne	sentinelone	SentinelOne, Singularity, Storyline, Deep Visibility, Purple AI, Ranger
Carbon Black	carbon-black	Carbon Black, CB Defense, CB Response, VMware Carbon Black, Broadcom EDR
Cortex XDR	cortex-xdr	Cortex XDR, Palo Alto XDR, XQL, BIOC, XSIAM, Causality View
Elastic Defend	elastic-defend	Elastic Defend, Elastic Security, Elastic Agent, Fleet, ECS
Sophos Intercept X	sophos	Sophos, Intercept X, CryptoGuard, Sophos Central, Deep Learning
Wazuh	wazuh	Wazuh, OSSEC, open-source EDR, FIM, SCA, Wazuh indexer

EDR Platform Comparison

Feature Matrix

Capability	CrowdStrike	Defender MDE	SentinelOne	Carbon Black	Cortex XDR	Elastic Defend	Sophos	Wazuh
Deployment model	Cloud-native	Cloud (M365)	Cloud/on-prem	Cloud/on-prem	Cloud	Cloud/self-hosted	Cloud (Central)	Self-hosted
Agent footprint	~25MB, lightweight	Built-in Windows	Light	Moderate	Moderate	Via Elastic Agent	Moderate	Lightweight
NGAV prevention	Yes	Yes	Yes	Yes	Yes	Yes	Yes (Deep Learning)	Limited
Behavioral EDR	Yes (IOA)	Yes (E5)	Yes (Storyline)	Yes	Yes (BIOC)	Yes	Yes	Yes (rules)
Threat hunting	CQL / Falcon Insight	KQL Advanced Hunting	Deep Visibility	Solr/CB Search	XQL	Kibana / EQL	Sophos Central	OpenSearch
Auto-response	Yes (RTR)	Yes (AIR)	Yes (1-click rollback)	Yes (Live Response)	Yes (Live Terminal)	Yes (response actions)	Yes (AAP)	Yes (active response)
MITRE ATT&CK mapping	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
XDR / SIEM integration	Falcon LogScale	Sentinel / Defender XDR	Singularity Data Lake	SIEM connectors	Cortex XSIAM	Elastic SIEM	Sophos MDR	Built-in SIEM
Managed service	OverWatch / Complete MDR	Microsoft Threat Experts	Vigilance MDR	CB TAU	Unit 42 MXDR	N/A	Sophos MDR	N/A
Open source	No	No	No	No	No	Partial (EL2.0)	No	Yes (GPLv2)
Licensing model	Module tiers	M365 E3/E5	Core/Control/Complete	Standard/Enterprise	Varies	Subscription	Central-based	Free (support paid)

Deployment Decision Guide

Choose CrowdStrike when:

• Cloud-native architecture is required with no on-premises infrastructure
• Managed threat hunting (OverWatch) is a priority
• Large enterprise with strict sensor footprint requirements
• CrowdStrike's Threat Graph AI correlation is valued

Choose Defender for Endpoint when:

• Organization is Microsoft-centric (M365 E5 or E3)
• Integration with Azure AD, Intune, Sentinel, and the full Defender XDR suite is needed
• Want built-in vulnerability management (Plan 2)
• Windows-heavy environment with ASR rules for hardening

Choose SentinelOne when:

• Autonomous response without cloud connectivity is required
• 1-click rollback capability is a priority for ransomware recovery
• Strong macOS and Linux coverage is needed
• Natural language threat hunting (Purple AI) is appealing

Choose Carbon Black when:

• Deep process-level forensic visibility is required
• Full endpoint recording (continuous data capture) is needed
• Existing VMware/Broadcom infrastructure
• Note: Evaluate roadmap carefully post-Broadcom acquisition (2023)

Choose Cortex XDR when:

• Palo Alto NGFW and Prisma Cloud are already deployed (native integration)
• Cross-domain correlation (endpoint + network + cloud + identity) is the priority
• Built-in SOAR capabilities (XSOAR integration) are needed

Choose Elastic Defend when:

• Already running ELK/Elastic stack for SIEM
• Open-source/cost-sensitive environment
• Custom detection rule development is a core requirement
• Flexibility in data pipeline is needed

Choose Sophos Intercept X when:

• SMB or mid-market organization
• Deep learning malware detection without behavioral overhead is preferred
• Integrated MDR service (Sophos MDR) is attractive
• Simple central management via Sophos Central

Choose Wazuh when:

• Open-source (GPLv2) is a hard requirement
• Combined HIDS + FIM + SCA + SIEM in one platform is needed
• Regulatory compliance automation (PCI DSS, HIPAA, GDPR) is required
• On-premises or air-gapped deployment is mandatory

Cross-Platform EDR Concepts

Detection Methodology Framework

EDR detection operates across multiple layers:

1. Signature-based (IOC)

• Matches known-bad file hashes, IP addresses, domains
• Pros: Low false positive rate, fast, deterministic
• Cons: Blind to novel threats, evaded by simple obfuscation

2. Behavioral (IOA)

• Detects patterns of behavior regardless of specific file or hash
• Examples: process injection, credential dumping patterns, lateral movement
• Pros: Catches novel threats, obfuscation-resistant
• Cons: Requires tuning, can generate false positives

3. Machine learning / heuristics

• Statistical models trained on malicious and benign samples
• Pros: Generalize to new variants
• Cons: Model quality varies, explainability challenges

4. Threat intelligence correlation

• Enriches detections with external context (actor attribution, campaign tracking)
• Used by Threat Graph (CrowdStrike), Threat Analytics (MDE), Unit 42 (Palo Alto)

MITRE ATT&CK Integration

All major EDR platforms map detections to the MITRE ATT&CK framework:

• Tactics: High-level adversary goals (Initial Access, Execution, Persistence, etc.)
• Techniques: Methods used to achieve tactics (T1059.001 = PowerShell)
• Sub-techniques: Specific implementations

When evaluating EDR coverage:

1. Run ATT&CK evaluations (MITRE publishes annual EDR evaluations)
2. Map your threat model to relevant ATT&CK techniques
3. Validate platform coverage for those specific techniques
4. Do not rely solely on vendor ATT&CK coverage claims

Telemetry vs. Detection

Telemetry = raw endpoint event data collected (process starts, file writes, network connections, registry changes, DNS queries) Detection = alert generated from telemetry matching a detection rule or ML model

Key distinction: An EDR may collect telemetry for an event without generating a detection. This matters for:

• Threat hunting (searching telemetry for IOCs after-the-fact)
• Forensic investigation (reconstructing attack timelines)
• Compliance (demonstrating data was collected)

Telemetry retention varies by platform:

• CrowdStrike Falcon Insight: 90 days (default)
• Defender MDE: 30 days (Advanced Hunting)
• SentinelOne Deep Visibility: 90 days (Complete tier)
• Elastic: Configurable (limited by cluster storage)
• Wazuh: Configurable (limited by indexer storage)

EDR vs. XDR

EDR (Endpoint Detection & Response): Focused on endpoint telemetry — processes, files, registry, network connections from the host perspective.

XDR (Extended Detection & Response): Cross-domain correlation across endpoint + network + cloud + identity + email. Reduces alert fatigue through correlated incidents.

True XDR platforms: Cortex XDR (Palo Alto), Defender XDR (Microsoft), Singularity (SentinelOne with Data Lake). EDR-first platforms with XDR evolution: CrowdStrike (Falcon platform), Elastic Security.

Response Action Taxonomy

Action	Description	Platforms
Host isolation	Cut off all network except EDR comms	All major platforms
Process kill	Terminate a running process	All major platforms
File quarantine	Remove and vault a suspicious file	All major platforms
Rollback / remediation	Reverse attacker changes (registry, files)	SentinelOne (1-click), MDE (AIR), CrowdStrike (RTR)
Remote shell	Live interactive session on endpoint	RTR (CrowdStrike), Live Response (CB), Live Terminal (Cortex)
Memory forensics	Dump process memory for analysis	CrowdStrike RTR, CB Live Response, Elastic response
Network containment	Block specific IPs/domains without full isolation	Varies by platform

Reference Files

Load these for cross-platform deep knowledge:

• references/concepts.md — EDR fundamentals: behavioral detection, IOA vs. IOC, MITRE ATT&CK methodology, telemetry architecture, detection engineering lifecycle. Read for conceptual and methodology questions.

For platform-specific deep knowledge, read the appropriate sibling skill and its references:

• crowdstrike (plus its own references/)
• defender-endpoint (plus its own references/)
• sentinelone (plus its own references/)
• carbon-black
• cortex-xdr
• elastic-defend
• sophos
• wazuh (plus its own references/)